44 lines
1.4 KiB
Text
44 lines
1.4 KiB
Text
===========================================================================
|
|
|
|
If you want to run Suricata in IDS mode, add to /etc/rc.conf:
|
|
|
|
suricata_enable="YES"
|
|
suricata_interface="<if>"
|
|
|
|
NOTE: Declaring suricata_interface is MANDATORY for Suricata in IDS Mode.
|
|
|
|
However, if you want to run Suricata in Inline IPS Mode in divert(4) mode,
|
|
add to /etc/rc.conf:
|
|
|
|
suricata_enable="YES"
|
|
suricata_divertport="8000"
|
|
|
|
NOTE:
|
|
Suricata won't start in IDS mode without an interface configured.
|
|
Therefore if you omit suricata_interface from rc.conf, FreeBSD's
|
|
rc.d/suricata will automatically try to start Suricata in IPS Mode
|
|
(on divert port 8000, by default).
|
|
|
|
Alternatively, if you want to run Suricata in Inline IPS Mode in high-speed
|
|
netmap(4) mode, add to /etc/rc.conf:
|
|
|
|
suricata_enable="YES"
|
|
suricata_netmap="YES"
|
|
|
|
NOTE:
|
|
Suricata requires additional interface settings in the configuration
|
|
file to run in netmap(4) mode.
|
|
|
|
RULES: Suricata IDS/IPS Engine comes without rules by default. You should
|
|
add rules by yourself and set an updating strategy. To do so, please visit:
|
|
|
|
http://www.openinfosecfoundation.org/documentation/rules.html
|
|
http://www.openinfosecfoundation.org/documentation/emerging-threats.html
|
|
|
|
You may want to try BPF in zerocopy mode to test performance improvements:
|
|
|
|
sysctl -w net.bpf.zerocopy_enable=1
|
|
|
|
Don't forget to add net.bpf.zerocopy_enable=1 to /etc/sysctl.conf
|
|
|
|
===========================================================================
|